Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
KQL Query from file: CVE-2025-21298 Zero-Click RCE
KQL Query from file: BlueAlpha GammaDrop Detection
KQL Query from file: Hunting NonEuclid RAT
KQL Query from file: Hunting Malicious Chrome Extension
KQL Query from file: CVE-2025-24054 NTLM Exploit in the Wild Detection
KQL Query
KQL Query
KQL Query from file: Hunting Malicious Chrome Extension
KQL Query from file: MDE KQL to detect UAC bypass of Fickle Stealer
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 19052025
KQL Query from file: glibc critical vulnerability (CVSS 9.8)
KQL Query from file: Detecting Windows Downdate Abuse
KQL Query
KQL Query from file: CVE-2024-43452 PoC Detection
KQL Query
KQL Query from file: Hunting Malicious Chrome Extension
KQL Query from file: Detect CVE-2024-43572 Abuse
KQL Query from file: Golden Chickens TerraLogger Detection
This rule detects the creation of hidden files or directories on Linux systems. It specifically looks for common commands like 'mkdir', 'nano', 'touch', 'vi', or 'vim' being executed with arguments that start with a '.' (dot), which is the standard convention for hidden files and directories in Unix-like operating systems. This behavior is often used by adversaries for defense evasion.
This query lists files copied to USB external drives with USB drive information based on FileCreated events associated with most recent USBDriveMount events befor file creations. But be aware that Advanced Hunting is not monitoring all the file types.
'This hunting query looks in Azure Web Application Firewall data to find possible SpringShell Exploitation Attempt (CVE-2022-22965).
The Spring Framework is one of the most widely used lightweight open-source framework for Java. To exploit the vulnerability attackers can
send a specially crafted query to a web server running the Spring Core framework to change the target of logging facility and create a new
malicious JSP file in a location accessible by http requests. Attackers then make requests to the malicious backdoor to run system commands.
Reference: https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/'
The Spring Framework is one of the most widely used lightweight open-source framework for Java. To exploit the vulnerability attackers can
send a specially crafted query to a web server running the Spring Core framework to change the target of logging facility and create a new
malicious JSP file in a location accessible by http requests. Attackers then make requests to the malicious backdoor to run system commands.
Reference: https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/'
Page 203 of 217